Application and Proxy Monitoring GCTD Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company's web application is experiencing a distributed denial-of-service (DDoS) attack. The attack is characterized by a high volume of requests to a single endpoint, each with a different source IP. The team has access to both application and proxy logs. What is the most effective way to differentiate between legitimate traffic and the attack?

   • ABlock all traffic from IPs that are not in the company's known customer list.
   • BUse the proxy logs to identify the source IPs and block the ones with the highest request rates.
   • CRely on the application's built-in rate limiting to handle the attack automatically.
   • DLook for patterns in the application logs such as repeated requests to the same endpoint with similar payloads or user agents.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is a typical first response step after an alert is triggered for a potential application or proxy threat?

   • ATriage the alert to verify if it is a true positive or false positive
   • BIgnore the alert if it occurs during off-hours
   • CImmediately shut down all cloud services
   • DDelete the relevant logs to prevent data leakage
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team is implementing a forward proxy to monitor outbound traffic from a cloud environment. They need to ensure that all traffic from virtual machines is inspected, including traffic that uses non-standard ports. What is the most important configuration step?

   • AConfigure the proxy to listen on all ports and enforce that all egress traffic is routed through the proxy.
   • BDeploy the proxy in a separate VPC and peer it with the application VPC.
   • CEnable logging on the proxy for HTTP and HTTPS only.
   • DInstall a web application firewall on the proxy.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is a key component of an alerting strategy for threats detected through application and proxy monitoring?

   • ADefining thresholds and rules that trigger alerts on suspicious activity
   • BDisabling alerts to avoid alert fatigue
   • CStoring alerts in a separate database without any action
   • DSending alerts only to the application development team
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of application monitoring in the context of cloud threat detection?

   • ATo replace network firewalls by inspecting all inbound and outbound traffic at the application layer.
   • BTo automatically patch vulnerabilities in cloud-hosted applications without human intervention.
   • CTo collect and analyze application-level events and metrics to identify anomalies and potential security threats.
   • DTo manage user access permissions and enforce identity policies for cloud applications.
   Reveal Solution Discussion Select an answer first